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[57] ABSTRACT 

A computer based records management system comprises an 
information filter for assuring that record data units offered 
to the system for storage are complete and not redundant. 
These record data units may be electronic in nature, scanned 
from paper, digitally formed from audio, video or otherwise 
formed as digital data information media, an objective of the 
disclosed system being to eliminate paper or microform 
record keeping. If record data units comprising documents 
are incomplete or redundant, the data units may be queued 
for special handling, returned or otherwise disposed of. 
Record data units accepted for system entry are admowl- 
edged and preferably tagged to enable tracking and for- 
warded for unit verification and certification. Verification 
and certification includes examination of units for compU- 
ance with preset criteria. Once a unit is found to meet the 
criteria, the unit is stored in permanent storage along with a 
disposal schedule determined for that unit. Only users meet- 
ing predetermined security levels may alter or dispose of a 
stored unit prior to scheduled disposal. Moreover, reasons 
for such alteration or destruction are required from the 
cleared user, and an associated data field must be completed. 
Consequently, the present system provides for record data 
unit tracking and audit trails in the event of any requirement 
for regulatory or legal compliance with discovery or other 
record imit requests. The present invention also permits 
reconstruction of the record units of an enterprise in the 
event of a catastrophic event. 

38 Claims, 10 Drawing Sheets 
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COMPUTER BASED RECORDS handled on a case basis* with only database pointers (not 

MANAGEMENT SYSTEM METHOD filed images) being marked for deletion. Images are almost 

always written to a single medium, e.g., permanent write 

FIELD OF THE INVENTION once read many (WORM) optical platters, from which they 

The present invention relates to records management. In ' cannot be purged. Audit logging capabilities in such systems 

particular, the invention concerns computer based systems .^V Product, from none to partial loggmg of system 

and methods for, inter alia, capturing, retaining, retrieving, activity. . . ^ . . 

tracking and/or disposing of documents within a business Available imagmg systems do not provide for the mte- 

orsani^ion gration of records management functions which automate 

10 the handling of records retention and destruction. They also 

BACKGROUND OF THE INVENTION do not consider automation of those areas required to assist 

Business Problem — Records Management with legal admissibility of stored records in courts of law. 

Most organizations have a need to create and retain Procedures surrounding admissibility questions are, 

records which document their business transactions and therefore, left to manual handling, which is time-consuming 

related processes. Eventually, after legal, regulatory and 15 and subject to error and omission. 

other requirements have been met, many of these records Further, the available imaging systems do not track dupli- 

can be destroyed. In those organizations having a formalized cate copies of stored records which may have been retained 

program of records retention and destruction, documents are on paper or in other form within an organization that 

most often stored as paper in filing cabinets on-site and may inadvertently may not have been destroyed when other 

also be microfilmed or microfiched. The film or fiche is 20 copies of the file were purged, 

typically retained on-site with an archival copy stored in an Business Problem — Disaster Recovery 

off-site archival location. Paper records of completed trans- Current system back-up and record archival processes 

actions are often boxed and sent off-site to be warehoused in provide, in an aggregated fashion, back-up for an organiza- 

an archival facility. tion's records in the event of a disaster. When an imaging 

As required in the course of business, warehoused boxes 25 application has been implemented, some or all of an orga- 

aie recalled &om the archival facility as access to the paper nization's paper-based records may also be recoverable, 

originals is required for litigation or other reasons. Manage- However, because of the disparate nature of the hardware/ 

ment of these film and paper records is generally handled software platforms which create back-up records, the lack of 

through a stand-alone manual or computer system, devel- coordination between those platforms and the media on 

oped for the purpose, which tracks the location and retention 30 which the back-up records are archived, full recovery from 

period of these records. PeriodicaUy, retained records are a disaster could take an organization weeks or months, 

reviewed and destroyed by the organization or archival depending upon the types and number of records stored, 

facility. Destruction dates and frequency is determined by a Each individual platform must be separately restored from 

combination of external lequiiements and oiganizational previously saved backups and paper files without backup 

policy. 35 must be re-created, as far as possible, from externally 

Managementof computer-generated output from business maintained records (often from outside the organization), 

applications has been handled in various ways, with a view Synchronization of cross-platform data and records when 

toward system backup required for normal system restored then becomes (by default) a matter of how close in 

restoration/recovery in the event of a system malfunction or time each of the individual backups (being used to restore) 

as part of an organizational disaster recovery program. 40 was performed. 

Records generated from computer application systems. Obviously, any delays in the time required for a business 
which are considered to be part of a corporate program of or agency which has suffered a disaster (e.g., major destruc- 
records retention and destmction, are either saved as hard- tion from a fire, earthquake or wind storm) to become fully 
copy output or on magnetic media and sent to an off-site operational again represents tremendous cost to the organi- 
archival facility with a retention period and destruction (or 45 zation. This cost reflects the expenses of coming back 
scratch) date. on-line, coupled with the lost business opportunities expe- 
Scanned images of documents stored on optical media rienced while the system was not operational. In addition, 
through computer application systems are beginning to each back-up and recovery process imdertaken in the normal 
replace microfilming and/or microfiche in some organiza- course of business generates additional expense associated 
tions as an archival method, as is computer output to laser 50 with the potential inef&ciencies of non-synchronized back- 
disk (COLD) technology for computer system-generated up and the off-site storage of records, 
output. These systems manage the archival of documents or These inefficiencies may waste time and money even for 
computer output from a retention viewpoint only. Records recovery efforts less far-reaching than a major disaster (e.g., 
destruction is still handled through stand-alone systems where a single location goes down and multiple types of 
which track volume and location information for COLD 55 records and potentially multiple systems are involved). This 
data. Paper, where not destroyed after imaging, is also is because whenever an organization's record-keeping 
tracked through a stand-alone mechanism. This duplication efforts are not synchronized, reconstmcting to a point in time 
of records may cause confusion. In the event of litigation, for is difficult and generally also will be costly in terms of both 
example, issues may arise as to which source of such records time and money. 

should be the basis for a document production. Clearing up 60 Business Problem — ^Discoverability of Electronically- 

this confusion involves expensive use of time and resources Maintained Business Records 

to track and report potentially relevant, duplicated records. Back-ups made for purposes of disaster recovery, which 

Currently available imaging systems allow for scanning, are not currently tied to any fonnalized program of records 

indexing, filing, saving and retrieving of images but do not retention and destruction, may exist for long (even 

provide an integrated ability to track file retention and 65 indefinite) periods of time beyond their regularly intended 

initiate complete file destruction on a regular, scheduled destruction dates. Such back-ups may be admissible evi- 

basis, lypically, items deleted from such systems are dence in the event of litigation. The proliferation of elec- 
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tronic mail, sent within and without an organization and 
saved, as well as the contents of unmanaged personal 
computer hard-drives can, thus, present a substantial unrec- 
ognized potential exposure to organizations. Typically, even 
those organizations that are meticulous about maintaining 
retention of paper records have not yet dealt with the 
complex issues of managing electronic records in the same 
fashion, due to the unavailability of tools to do so. 
Related Art — General 

Currently, a few organizations are looking to systems 
integrators to assist with the marriage of off-the-shelf stand- 
alone records management systems with archival imaging 
applications. These application integration efforts, if 
successful, may solve that portion of the overall business 
problem which deals with the timely disposal of archived 
imaged records. The records management of current com- 
puter generated data, which generaUy remains a process 
apart from normal records management methods and 
procedures, will not be touched by those efforts, and the 
synchronization of archived files to provide an enterprise- 
wide capability to recover swiftly after a disaster will not be 
addressed. 

In addition, rapid changes in technology are continuing to 
impact organizations with new ways of communicating 
(e.g., inter- and intra-organizational electronic mail, systems 
which allow the direct generation and/or receipt of facsimile 
information, electronic data interchange (EDI) of data, and 
interactive voice response systems), all of which are records 
of information that should be incorporated into an organi- 
zation's records management system, and be subject to 
destruction according to an established records retention 
schedule. 

Because they are new, these communication methods 
remain largely unmanaged and are outside the scope of 
current records retention and destruction programs and 
vehicles. As electronic signatures, widespread use of EDI 
and inter-company systems become a general reality, the use 
of paper as a medium to record the business of an organi- 
zation will decrease. Each organizational entity must find 
new methods and vehicles of archiving, reviewing and 
ensuring the appropriate destruction of its records in accor- 
dance with policy and externally generated requirements. 
Prior Art — The Wye Oak System 

An imaging archival system developed within the past 
few years, but not widely used, the Wye Oak system, had 
three main functions: Scan, Retrieve and Systems Admin- 
istration. 

The Scan function allowed users to scan images into the 
system and to place (or file) the images into predefined case, 
folder and document categories. The Retrieval function 
allowed users to access images at their workstations, anno- 
tate the images, add case journal notes and print images to 
a designated printer. The System Administration function 
allowed for the setting of user passwords, controlled access 
to system features and to stored information (images), and 
also allowed the System Administrator to turn on or off a 
print audit log of all items printed through the application. 
Other audit logging was performed for the Scan function, 
but not for any other functions within the Wye Oak system. 

The Wye Oak system was a Microsoft Windows-based 
application written in Visual Basic and C language, and 
provided users with a graphic user interface (GUI) imaging 
system. The Wye Oak system also included the concept of 
a case journal. The case journal could be attached to a Wye 
Oak file by an authorized user and made either public or 
private, but the journal could not be deleted from the system 
once entered. The Wye Oak system had no built-in features 
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for records management (file retention and destruction) and 
could not handle non-imaged files. The system also did not 
contemplate use for disaster recovery purposes or for sup- 
port in litigation document production. 

5 

SUMMARY OF THE INVENTION 

In view of the foregoing, it is a principal object of the 
present invention to provide a ""cradle to grave" system and 
method for managing the records of an organization, 
whether retained as hard copy paper documents, microform 
or in electronic data formats, and whether text, recorded 
voice or other signals. 

It is a further object of the present invention to provide an 
-^^ integration of imaging, electronic document management 
and records management principles. 

It is another object of the present invention to provide for 
specified record types filtering and verification/certification 
mechanisms which will allow for deletion of transient, 
20 non-archival type information prior to saving required 
records. 

It is yet another object of the invention to provide, for 
records stored and archived under the system, mechanisms 
to alter retention information, to purge records on an indi- 

25 vidual or global basis at predefined intervals, and to generate 
audit records of all system activity, whether system- 
generated or resulting from manual intervention, so as to 
support legal admissibility of stored records. 

Still another object of the invention is to provide a 
mechanism for cross-referencing related records across mul- 
tiple record formats, types and media, and across different 
hardware/software platforms, for purposes of record 
retrieval, tracking, retention and destruction. 

Yet another object of the invention is to provide an 
organization with a central audit point for all electronic 
business conducted within the enterprise, thus ensuring that 
all records are captured and appropriately processed, and 
that external communications (such as acknowledgments) 

^ are also processed as necessary. 

A further object of the invention is to provide a system 
that, in the event of a disaster, will allow an organization to 
restore its records without the delays caused by uncoordi- 
nated efforts at back-up between various hardware and 

45 software processing platforms. 

These and other objects are achieved with the present 
invention. In one aspect, the invention is embodied in a 
computer based records management system and method 
according to the present invention. The computer based 

so records management system according to the present inven- 
tion comprises input devices for receiving record data units 
that may or may not be retained in the system and storing the 
record data units for possible retention. These record units 
may comprise scanned documents including or excluding 

55 marginalia, old microfilm records, information containing 
audio and video media, various computer generated media 
such as floppy discs, hard drive stored data and the like or 
practically any and aU media and data forms that may come 
to mind that a user may wish to store. 

60 One especially important element of the present invention 
is a unit verification and certification process whereby a 
record data unit is carefully examined for retention in the 
system in accordance with preset criteria. Once the unit is 
found to meet the preset criteria, the unit is stored in storage 

65 media along with record unit disposal schedules determined 
for that unit. Of course, as the disposal schedule requires, 
record imits are automatically destroyed in accordance with 
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the present invention. Practically all paper record keeping by which an organization may control the receipt, 

may be elimmated from an enterprise. Moreover, all paper or acknowledgment, validation, organization, destination, 

other records reduced to digital form are destroyed auto- storage, retention and destruction of multi-format machine 

matically in accordance with predetermined disposal sched- readable (both on-line and off-line) and hard-copy records 
ules. Also, via unit tracking, even paper records stored 5 used by the organization in conducting, documenting and 

off-site are identified and any record thereof not immediately reporting its activities for internal and/or external purposes, 
purged from the system until the disposal is verified by a in accordance with the present invention, unorganized 

records manager. (raw) data enters the process only after it has been assembled 

Another especially important element of the present by automated or manual means into usable information with 
invention is an information filtering process which occurs a definable and automatically recognizable format. Tempo- 
prior to verification/certification. During information rary (transient) information enters the process only for the 
filtering, incomplete or redundant units are identified and purpose of assuring that such information is located on 
such units, for example, may be acknowledged or forwarded appropriate media, that unnecessary backups are not taken 
for special handling or the like. Information filtering may and that all copies of such information are destroyed in a 
serve to route input record data units to designated destina- timely fashion. Version management is used to control/ 
tions. Preferably, data units passed on for verification/ reduce multiple iterations of electronic data which may be 
certification are tagged to enable tracking of units through resident within an organization, across applicable hardware 
the system, for example, for subsequent auditing. and software platforms and physical and geographic 

According to a method for managing records in a com- locations, both fot primary use and copies maintained for 

puter based system, the method comprises the afore- backup purposes. Copies of electronic information which 
mentioned steps of receiving record units for possible maintained (e.g. backup copies maintained on-site or 

retention, filtering the units according to preset criteria, and oflf-site for disaster recovery purposes) within an 

forwarding the units for verification/certification or other oiganization, either stand-alone or embedded within other 

operations, wherein said forwarded units are tagged for information, are tracked by format and location to ensure 

enabling tracking of units through the system. Once the units simultaneous and timely destmction of all copies maintained 

are verified and certified for retention, the units may be by the organization at the end of the scheduled retention 

retrieved for use by anyone having access to the system, but, period(s). Embedded information (e.g. images, spreadsheets 

according to predetermined security levels, only those users embedded into larger documents) assumes the life span of 

meeting those security levels may manipulate or destroy the any file into which it has been embedded. If the retention 

retained data units. period for embedded information is longer than that of a 

TTiese and other objects, feamres and advantages of the ^^^g^] file, prior to being embedded in that file, the retention 

present invention will be readily apparem and fully under- ^^f^^^ ^^"^ embedded mformation is 

stood firom the following detailed description of the pre- modilied. 

ferrcd embodiments. ,5 Except as necessary for recovery or other such purpose, 

multi-resident data (i.e. data maintained in multiple versions 

DETAILED DESCRIPTION OF THE DRAWINGS or locations) is normalized to the most recent (i.e. valid) 

no. 1 is a logical schematic overview of a preferred version, maintaiiied in a single location 

implementation of the presem computer-based system, ^« applications which require it. Version and locaUon 

;to „««-,.,.o cfoX*.. normalization occurs across databases for processed mfor- 

mcludmg its vanous data sources, lunctions and stages. 40 . . . i. ....... t- j j . 

Z . ' J mation and accounts for the distribution of localized data- 

FIG. 2 IS a schematic view showing in greater detail bases in multiple sites. This ensures the simultaneous update 
various possible data mput sources. ^^^^^^^^ simultaneous destruction of aU file versions. 

FIG. 3 is a logkal schematic view illustrating in greater ^^^^^ ^ implemented 

detail a retneval ftinction of the presem system. ^^^^^ ^ ^^^^ multi-organizational unit or may include 
FIG. 4 is a logical schematic view illustrating in greater partners of the organization where two-way elec- 

detail the verification/certification function shown in FIG. 1. j^onic communication is the preferred form of business 

FIG. 5 is a logical schematic view illustrating in greatest transaction handling. In the latter case, all partners should 

detail the record disposal function shown in FIG. 1. agree to abide by similar information management prin- 

FIG. 6 is a logical schematic view illustrating a further ciples and adhere to specified standards for data formatting, 

implementation of the present invention in an automated processing and communication. 

records archival facility providing on-line access (local or Non-electronic records, e.g., hard-copy documents and 
remote) to, and retrieval of, archived records (both on-line off-fine data storage media, are managed by electronically 
and off-line). tracking the printing and distribution information associated 
FIG. 7 is a schematic view illustrating the hardware, 55 with those records, and coordinating the external control 
software and network connectivity associated with an imple- procedures and information with a centralized ILM data- 
mentation of the present system in a large enterprise having base. 

numerous branch locations connected via a wide area net- xhe purpose of ILM is not stricUy to provide a "Big 

work (WAN), with a centraUzed storage of information at Brother" audit oversight of organizational information, but 

the corporate headquarters. rather to provide numerous other beneficial functions, one of 

FIG. 8 illustrates a record fifing (indexing) hierarchy in which is to help ensure that the smallest subset of validated 

accordance with the present invention. records is maintained by the organization at any one time. 

Maintaining a deliberately minimized database of docu- 

^?™?reSSm?i5^ -"""^ ("^"'"^ information benefits 

PREFERRED EMBODIMENTS organization by helping to minimize for oiganization 

The present invention, as depicted in FIG. 1, provides an members the ''noise" of information overload and confusion 



information location management (ILM) system and process caused by multiple, perhaps dissimilar, versions of files. In 
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accordance with the invention, necessary replicated versions computerized processing systems, such as EDI data streams, 

of databases for distributed architectures, and generations of etc.; (2) formatted electronic information intended for direct 

files retained for backup or similar purposes, are clearly receipt by individuals within the enterprise, such as direct 

defined with version and time stamp information, and aU digital input of computer aided tomography (CAT scans), 

replicated versions are synchronized across the enterprise. 5 magnetic resonance imaging (MRIs), etc; (3) unformatted 

A r»'r.\^ir,^A ^nf«koo^ oic^^ u«i«e «,o;«to,« e,,et««, electrodc informatioD intended for direct receipt by indi- 

A mimmized oatabase also helps to mamtam system • * . i_ i • •! j 

„„^, ^„*„JL -^^ „4v.ct^.^t,.r^ k,, viduals withm the enterprise, such as electronic mail and 

performance over the entire enterprise mfrasti^cture by ^^^^^^ documents, text files, etc.; and (4) hard copy 
mimmizmg the size of the mdex database which must be (nonKslectronic) information intended for direct receipt by 
searched in response to quenes or requests for informaUon. individuals within the enterprise, which must be scanned 
It also reduces the amount of mformation which must be sent lo ^^^^^ ^or to entry into the system, such as paper- 
over the network m response to such requests, thereby ooirespondence, photographs, blueprints, 
speeding access to mformation throughout the enterprise. .^^^^^^ .^^ J information enters the system 

ILM facihlates direct inter-organizational informaUon ^^^^ ^^^-^ enterprise (e.g., internally generated 

accessby traclaug the location of required informau^ documents, spreadsheets, text files, output from computer 

securing that mformation against unauthorized access. The processing systems, etc.). This information may also take 

system also tracks the intended destination of outbound ^^^y ^^^^^^ including: (1) formatted electronic information 

information (e.g., facsimdes, elearomc mail, EDI data crea-iod by computer appUcation systems and intended for 

streams) for audit and troubleshooting purposes. ^^^^^^ processing and/or backup for recovery purposes or 

In addition, ILM minimizes the ongoing potential liability intended to be sent outside the enterprise (e.g. EDI data 

associated with retaining information beyond established streams intended for trading partners, customers or other 

retention schedules by providing an automated method for third parties); (2) formatted electronic information created 

ensuring coinpliance with those retention schedules across by individuals or systems within the enterprise and intended 

the organization. to be sent outside of the enterprise, such as direct digital 

ILM provides a centralized audit point for troubleshooting input of computer aided tomography (CAT scans), magnetic 

when system failures or other problems require back- resonance imaging (MRIs), etc; (3) unformatted electronic 

tracking to determine a chain of events. Also, where appro- information created by individuals within the organization 

priate backups are taken, ILM can facilitate recovery after a and intended for either direct receipt by individuals within 

disaster by providing a single enterprise view of the status the enterprise or by individuals outside of the enterprise, 

and location of all stored information at a point in time ^ such as electronic mail and facsimile documents, text files, 

immediately before the disaster. etc.; and (4) hard copy (non-eleclronic) information 

Preferred features of a ILM-compliant system include: (1) intended for direct receipt by other individuals within the 

open (non-proprietary) architectural haidware, software, enterprise or by individuals outside the enterprise, which 

network and commuaicatioos components which comply must be scanned (digitized) prior to entry into the system, 

with industry standards for communications protocols and 35 such as paper-based correspondence, photographs, 

data formatting; (2) a mechanism to maintain control over blueprints, microfihn or microfiche to be converted to digital 

system resources (e.g. system catalogues) on multiple plat- form, etc. 

forms and in multiple geographic locations; (3) normaliza- Units of information which enter the system from external 

tion and tracking of stored documents, formatted data and sources 1 or internal sources 2 are termed "record data 

messaging across databases (this requires the creation and/or 4Q units". Record data units are defined as discrete, physical 

recognition of a unique identifying tag, e.g., containing units of data, whether in single or continuous form, which 

document/file name, creation source and date, file location, are characterized by one or more of: an identifiable begin- 

priority and certification data, for each record processed by ning and ending; a common creation date and time; a 

the system); (4) the ability to recognize the destination and common source and destination; a single type and format; 

source of information, to route in-coming information and to 45 and a common use or purpose. 

respond in real-time to electronic information entering the FIG. 2 shows in more detail the various possible data 
enterprise from external entities; (5) adherence to scheduled input sources. As shown in FIG. 2, external in-coming data 
retention parameters for all stored information across plat- record units include (1) in-coming formatted data lA, e.g., 
form databases; (6) security against unauthorized access to EDI data streams, spreadsheet files; (2) in-coming unfor- 
and/or modification of stored information, including such 50 matted data IB, e.g., electronic mail messages, facsimiles; 
security vehicles as encryption of access and stored infor- (3) scanned (digitized hard copy) input IC, e.g., scanned 
mation; (7) recognition of and control over electronically paper records, microfilm or fiche which has been digitized, 
maintained versions and iterations of files and documents photographs; (4) voice information ID, e.g., interactive 
within the enterprise infrastructure; and (8) creation and voice/keypad ordering input, which is converted to digital 
maintenance of a centralized audit point for all information 55 form; (5) direct digital input IE, e.g., digital camera input, 
created, stored and/or sent outside of the enterprise. video or information such as video which has been con- 
Referring now to the drawings, FIG. 1 is a logical verted to digital form; and (6) textual information IF, e.g., 
schematic overview of the present system including various word processing files or text files intended for use in text 
data sources, functions and steps. As shown in the Figure, search applications. 

information in electronic or other record formats may enter 60 FIG. 2 shows internal incoming information in the form 

the system, from multiple sources, including external of (1) applications systems output 2A, e.g., record data unit 

sources 1 or internal sources 2. files produced by personal computer, minicomputer or main- 

The external in-coming information comprises informa- frame business applications; (2) scanned (digitized hard 

tion which enters the enterprise from outside sources (e.g., copy) input 2B, e.g., scanned paper records, microfihn or 

external trading partners, clients, other third parties, etc.). 65 fiche which has been digitized, photographs; (3) formatted 

This information may take many forms, including: (1) data record units 2C, e.g., CAT scans, MRIs, etc.; (4) 

formatted electronic information intended for entry into unformatted data record units 2D, e.g., facsimile, electronic 
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mail messages; (S) direct digital input 2E, e.g., digital the same index criteria and date/time stamp data has already 

camera input, video, which is converted to digital form; and been archived) and determines whether potentially redun- 

(6) textual informatioD 2F, e.g., word processing files, text dant information is identified as replacement data intended 

files intended for use in text search applications. to overlay the existing file. Redundancy (and potential for 

Referring again to FIG. 1, record data units which enter 5 information resent from the source) is detected by accessing 

the system from external sources 1 or internal sources 2 are the central ILM database 13 and system audit file 9. Where 

either captured directly by the system or may be received by redundancy is detected, the record (e.g., file) is deleted from 

the system after first being created and oiganized by an the processing stream and sent to hold area 4. The deletion 

individual or automated process. In those instances, such and the potential redundancy is then reported to the Records 

records may then be organized by those processes into the 10 Manager or other central facility for resolution and for audit 

logical file formats in which they will ultimately be archived purposes. 

and retrieved. (A preferred record filing structure is shown Filter 3 further verifies whether information has previ- 

in FIG. 8 and described below.) ously been processed by the enterprise applications or is still 

If incoming records (e.g., direct digital input) are to be to be processed or received by the destination address, 

retained by the system, these records are organized for 15 Where the information has yet to be processed or received, 

archival by the system upon receipt within the enterprise. In the filter first verifies the information integrity and then 

most cases, retention periods and conditions (e.g. upon returns any necessary acknowledgments to the source, logs 

receipt, after completion etc.) will be controlled by the the receipt of the information and routes the information to 

organization's established schedule of records retention and the proper destination, e.g., business applications 5 or user 

destruction, maintained within the system database. 20 work station 7. The filter also reviews the priority assigned 

Information Filter: to the incoming records (from an internally maintained table 

Still referring to FIG. 1, the system preferably initially orby reading a priority indicator received with the incoming 

processes records presented for possible retention through data) to ensure timely processing of priority information, 

an information filter 3. This information filter acts as a Priority records which require processing are forwarded 

"black box" between the creation and receipt of record data 25 with the appropriate priority processing indicator or flag, 

units within the enterprise and all fiirther processing. In the preferred implementation, the filter determines 

backup, receipt and logging of this information. The filter, which coded information is maintained for validation, 

thus, handles the preliminary validation, routing, processing, retention, retrieval, information collection and 

acknowledgement, priority verification, buffering and simi- dissemination and ultimate disposal for a single or multiple 

lar functions and provides any necessary translatk>n, param- 30 organization unit. The filter attaches to incoming records a 

eter passing, etc., by means of internally maintained tables. tag (i.e., envelope, pointer or reference entry prior to appli- 

For multi-national organizations or those who engage in cation processing) which can be associated with a database 

international communication or commerce, the filter may, in in order to track the source, destination, version, storage 

certain implementations, recognize the language used on locatioa(s) and retention data associated with the record, 

in-bound communications and incoiporate either translation 35 Where information does not enter the filter, e.g., scanned 

or tagging information as required by the down-stream input, appropriate tag (or tracking) information is added 

applications or recipients. during the verification/certification process. For interoally- 

The purpose of the filter is to ensure that record data units created information, created either at the individual work- 
received, either from external sources or internally created, station or by business applications, information considered 
are appropriate for further processing or handling within the 40 to be important for saving may be sent to the filter for 
organization, including verification/certification for archi- tagging, prior to being released either internally for further 
val. The specific functions performed by the filter at any handling, or externally to trading partners, etc. Where no 
given time will generally depend on the particular format, further handling other than verification/certification is 
type and destination of the record data units being handled. required, such information may be routed directly to the 
However, certain functions are performed on all incoming 45 verification/certification module for operator handling. In 
information regardless of format, type and destination. either case, incomplete information is trapped and sent to 

Information format means the verifiable structure of the bold area 4 and held for input of the necessary processing 

in-coming information, such as a formatted EDI data stream. information by the Records Manager or other designated 

Information type is determined by the source (technology) individual. 

of the in-coming record data units, such as voice, video, so As described above, the specific functions of the filter 

pre-processed data, etc. Information destination means the depend, at least in part, on the format of the particular 

computer platform and application or other direct intended information being handled. Thus, in the case of formatted 

recipient of the information. electronic information, the filtering process will further 

In the preferred embodiment, filter 3 captures incoming determine whether the record is in a recognizable format that 

external information, as well as record data units of infor- 55 may be opened, read and closed by applications requiring 

mation created within the enterprise, and parses the infor- access to the record, and whether the information is com- 

mation for further processing. The filter, thus, determines plete (e.g. has an appropriate end-of-file marker or valid 

whether required header or index data exists (e.g. location, close parameter). The filter also will determine whether 

date/time data, etc.) and also whether appropriate filing and acknowledgment of receipt, including electronic signature 

index criteria has been created. Where necessary filing 60 validation, is required by the sending entity (and ensure that 

(indexing) data does not exist, the record or file is transmit- appropriate acknowledgment is sent), and whether the des- 

ted to a hold area 4 and held for input of the indexing tinatioa of the record is clear and in accordance with 

information by the Records Manager or other designated oiganizational parameters (e.g., whether the record must be 

individual in connection with the verification/certification processed further before storage), 

process described below. 65 In addition, using in-coming header data and/or internally 

Filter 3 also checks incoming information for redundancy maintained tables, the filter will determine whether there is 

with currently archived records (e.g., whether a record with a need for special handling of the information (e.g., 
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translation) prior to routing the information to the defined 
destination. Where special handling is required, the filter 
tags or routes the information to Special Handling module 
22. For formatted information intended for direct receipt by 
individual(s), the filter determines the number of recipients 5 
and the appropriate destinations (e.g. workstalion(s), net- 
work storage), based upon the requirements (e.g. size, type) 
of the in-coming information. 

In the case of unformatted electronic information, the 
filter verifies destination and priority information and, in the lo 
case of information intended for direct receipt by individual 
(s), determines the number of recipients and the appropriate 
destination (e.g. workstation(s), network storage), based 
upon the requirements (e.g. size, type) of the incoming 
information. Also, using data on incoming record data units 15 
and/or internally maintained tables, the filter verifies the 
need for special handling of the information (e.g., optical 
character recognition processing) prior to routing to the 
defined destination, and where special handling is required, 
tags or routes the information to Special Handling module 20 
22. 

For digitized hard-copy information, the filter verifies that 
the desrination (e.g., file structure and file index 
information) information is clear. 

Aside from format-driven functions, the filter performs 25 
certain functions for all incoming information, regardless of 
format or type. For example, the filter generates necessary 
information tags for all units of information processed 
through the filter. These tags contain the following infor- 
mation — information unit identifier, information source, 30 
destination, version or date, and, where applicable, retention 
and storage location data. 

The fiher also attaches priority and other pertinent infor- 
mation to the information units (e.g., *'do not save" flag for 
items not to be backed up) and places incomplete, redundant 35 
(not identified as appropriately re-sent) or otherwise appar- 
ently inaccurate information on "Hold" in hold area 4. This 
information is reported to the Records Manager message 
queue or other appropriate location for further action (see 
arrow 5A). 40 

The filter further sends tagged, complete information to 
the destination recipient i.e., user workstation 7 or business 
applications 5, for further processing, and receives informa- 
tion returned from Special Handling module 22 and routes 
that information to the destination recipient or application. 45 
The original file sent for special handling is maintained at 
Special Handhng module 22 in temporary storage with a 
limited retention period, e.g., 90 days, until processing of the 
information is complete. Where information intended for 
direct receipt cannot be delivered, the filter sends acknowl- 50 
edgement and, as appropriate, stores the incoming informa- 
tion in data buffer 6 for later delivery. The filter further logs, 
to audit file 9, all appropriate information (multiple 
recipients, acknowledgements, non-delivery, items held, 
special bandling,etc.) The audit file can be used by the ss 
Records Manager or other authorized persons to provide 
system reporting on audit-related matters. 
Information Processing 

Electronic information which leaves information filter 3 
after being parsed (or information which has received spe- 60 
cial handling and is now being routed to its destination) is 
routed to business applications 5, user workstations 7 or the 
Records Manager hold area 4. 

Items of information intended for individual receipt, such 
as facsimiles^ electronic mail messages, electronic forms and 65 
files, etc. are routed to the identified user workstations. 
Where storage requirements prohibit routing to the 
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workstation, the data is stored on the network (described 
hereinafter with respect to FIG. 7) and a workstation noti- 
fication message with appropriate access information is sent 
to the recipient, who will then access the stored information 
on the network. 

Data streams intended for processing by computer appli- 
cations are routed to a hold queue and a message is sent to 
the console controlling that application. 

Record items which are intended for real-time receipt 
(e.g. video and/or audio transmissions) are routed immedi- 
ately to the receiving address. If this routing cannot be 
completed, a message is returned to the sender and the 
routing attempt is logged for audit purposes. Where 
possible, the incoming record is buffered in data buffer 6 for 
delayed routing as resources become available. 

Record data which is intended to overlay another version 
of that data at the same storage location is updated after an 
audit record of "before" and "after** data is sent to the central 
ILM database 13. 

Scanned (digitized hard copy) information which leaves 
the user workstation is sent directly to verification/ 
certification module 10, for processing by an operator, i.e., 
the Records Manager or other designated person with 
authority over the retention of records within the organiza- 
tion. The verification/certification module receives informa- 
tion from multiple sources^ and is described below. 

Record data units of information received at the destina- 
tion are processed by business applications 5 or otherwise 
handled at user worl^tations 7. Where the processed infor- 
mation is to remain internal to the enterprise, appropriate 
backups will be taken by backup module 8 subsequent to 
processing for recovery purposes. 

Appropriate backups will also be taken by backup module 
8 of information at the workstation (or information saved on 
network drives), including a special backup of identified text 
files which may later be utilized for text search applications 
of text database 12. 

In the present system, information is processed by an 
organization's systems and personnel outside of the actual 
ILM system itself. The ILM system will, however, continue 
to interface with those systems and workstations to track 
tagged information through its many stages within the 
organization, from receipt and initial parsing through 
processing, backup and eventual disposal. This tracking is 
made possible by the information tagging done by the filter, 
which uniquely identifies every unit of information which is 
considered important for the enterprise to retain (i.e., not 
every piece of information created within the organization 
will be tracked for retention). Information which will gen- 
erally be considered important for retention includes (1) 
information which is part of an organization's official 
records retention schedule; (2) information required to be 
backed up as part of a potential recovery process in the event 
of a disaster or computer failure, including external incom- 
ing information intended for input into business applications 
which will result in that backup process; (3) incoming 
information, preidentified to the filter by source, type and 
format, which is intended for input into business applica- 
tions or to be routed directly to recipient(s); and (4) infor- 
mation created within the organization which is routed to the 
filter for tagging by an individual or process prior to any 
subsequent handling based upon a determination that such 
information is important to a business transaction or other 
affairs of the enterprise. 

Information not considered to be important for retention 
may either enter the filter (e.g., external incoming electronic 
mail messages which are not to be saved by the organization 
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and which would leoeive a ''do not save" flag from the filter 
or deleted, redundant data) or may not enter the filter (e.g., 
created and saved on the user's workstation hard drive and 
not considered necessary to be saved by the workstation 
user). Such decisions are made both at the filter level and by 
individual system users, including the Records Manager. 
ILM Capture and Update 

Previously processed or otherwise handled (e.g., viewed 
at user workstation) informatioa which is to be archived 
within the organization is captured, in the preferred 
implementation, prior to being processed for verification and 
certification. This capture is performed to ensure that the 
current location and version information, subsequent to 
processing and system backups, is capnired for all informa- 
tioa processed via business applications across multiple 
platforms, including such information for all replicated 
databases. It also ensures that the information sent to user 
workstations (and any subsequent backups taken), which is 
to be subsequently archived, is complete and organized for 
subsequent filing by the verification and certification func- 
tion; that all necessary preprocessing of text files to be 
archived is done to ensure appropriate handling by subse- 
quent text searches; and that information which should not 
be backed up (e.g., flagged as "do Not Save") has not been 
backed up after processing or viewing. For all captured 
information, a preliminary update of location and version 
data to the central ILM database is done prior to processing 
by the verification/certification function. 

To explain further, location and version information oon- 
ceming uncertified or pre-certified records is captured by 
ILM capture module 11 for update to ILM database 13 prior 
to any processed information entering verification/ 
certification module 10. This update is done for recovery 
purposes, in the event of system failure during processing. 
Location and version information is captured for all out- 
bound information, i.e., information created for sending to 
destinations outside of the enterprise, by either business 
applications 5 or user workstations 7; for all processed 
information intended to remain internal to the enterprise; 
and for all text files identified for later use by text search 
applications. 

Outbound information or record data imits may consist of 
processed data files, such as EDI data streams produced by 
business applications 5. It may also consist of information 
produced at a specific user workstation 7 (e.g., text files, 
images faxed, etc.), which is considered by the organization 
or user to be important to the business of the enterprise and 
therefore, important to be tracked. At the user workstation 
level, the decision to trade outbound information is made by 
the individual user. 

Most processed information files are created, backed up 
and sent to the appropriate external destination or regular 
internal storage location. For these files, version and location 
information is captured for the purpose of managing reten- 
tion and eventual disposal only. 

Information coming directly from the user workstation 
(including scanned documents) will not normally enter the 
ILM capture module but will do so if the information 
requires further internal processing (other than verification/ 
certification) and has been sent to the filter for tagging and 
routing or the information is being sent outside of the 
enterprise and is considered important t>e to be tracked by 
the workstation user. Such information will also enter the 
ILM capture module if the information is textual in nature 
and will be utilized further by the organization for text 
retrieval applications. 

Hie purpose of capture is to ensure that the location of all 
information intended for retention by the organization is 
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maintained. This is done to create a complete and normal- 
ized database of information critical to the enterprise; the 
state of the information within the enterprise is maintained 
at all times in the event that audit or recovery from failure 
or disaster is required. 
Verification/Certification (FIGS. 1 and 4) 

Records (image or non-image) are not accepted for archi- 
val within the present system or viewing through the 
Retrieval function unless the documents are first "certified." 
Certification ensures that documents and files are placed 
within the correct filing structure and associated with the 
proper documentation. It also ensures that the documents or 
files have been properly captured (through scanning or 
import) and have the appropriate retention information 
attached. 

Sub-document pages (image or non-image) may be 
viewed and certified, deleted or placed on hold status if 
questions arise which must be answered prior to certifica- 
tion. Certification involves viewing the images or electronic 
records attached to the sub-document for clarity and cor- 
rectness and proper filing within a case. Default retention 
information may be changed during this process and the 
reason for such change entered for audit logging. 

The act of certification moves the sub-document within 
the system from the temporary network storage location to 
a permanent filing location (cabinet), which may reside on 
disk or on permanent or erasable optical media. Certification 
provides the quality control assurance often needed in legal 
proceedings to address the admissibility question concern- 
ing the knowledge and skill of the individual(s) who created 
the record in the normal course of business. Certification 
replaces, in the on-line records management world, the act 
of verifying microfilmed images in the miaographics arena. 

For processed information, a system verification/ 
certification module 10 determines the appropriate security 
level and vehicle for retrieval of the archived information 
and provides additional edits to verify the accuracy of 
header/index information (e.g. that a normal end of file on 
EDI data stream exists). For textual information where text 
search and retrieval may be needed, the location and header 
information of the text file be saved for referencing 
when text searches are performed. 

The verification/certification process is performed in 
either of two ways, i.e., by an operator viewing the records 
to be certified or automatically without operator interven- 
tion. In cases of operator inten^ention, the operator may 
query audit file 9 for information concerning the status of 
information under review. 

Operator intervention, which requires access to security 
module 20 for verification of operator authority, is required 
in circumstances where resolution is required for 
incomplete, redundant or other potentially inaccurate infor- 
mation which has been placed in hold area 4 by information 
filter 3. Operator intervention is also required where digi- 
tized (e.g., scanned) hard copy documentation is reviewed 
for completeness of indexing information, filing placement 
and appropriate retention information, including storage 
media. 

In addition, operator intervention is required where error 
conditions are detected during the filter, audit, special 
handling, data buffering, ILM capture or database update 
operations which require manual intervention. Errors occur- 
ring outside system boundaries (e.g., within business 
applications, user workstations or backup processes) should 
be monitored and corrected within those processes, but may 
be detected by the ILM capture module. 

Operator intervention is further required where informa- 
tion enters the system, either through information filter 3 or 
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from a user worlcstation 7, for which no pre-defined reten- catalogues remain synchronized after destruction, (see 

tion information is available; and where manual tracking FIGS. 1 and 5, block 16). The best, but not the only method 

information 23 for manually held records must be manually of implementing the invention, ensures that, as required, 

keyed into the system for later use by the disposal module JCL or other appropriate commands will be issued by the 

5 system to synchronize all affected system catalogues. Where 

Operator intervention is not required for processed appU- microform or paper records are destroyed, the Records 

cation data files, which are automatically certified and sent Manager will oversee the process and eater destruct certi- 

directlytopennanentstoragemedial9, where themed^ ^^^^^^ 3 ^3^^ PIGS ^ 5^ ^j^^j^ 

retention parameters are pre-defined withm the sys ein. ^h^ ^^^^^ ^^e link between stored versions of 

Storage media 19 may be directly controlled by multiple unprocessed information received from external entities and 

hardware/software platforms. In cases of automatic , r .t. . - c . i_ 

verification/certification processing, the system wiU access P^^^^^, T'"""^ . ih^i same informaUon so that both 

the audit file 9 during the verifica^on process. ^^^^ ^^^.^ ^ ^^""^^^ will receive the same handhng 

Also, where large, processed computer files are received f^^ ^^^^^^^^ ,f°d destniction^The system will store the 

by the system for COLD (Computer Output to Laser Disk) location of all on-site and off-site versions of electronic 

storage (e.g., computer report runs), the verification/ 15 information, including backups and repUcated databases, 

certification process will receive these runs and route them Records managed by the present system and method may 

to final storage location(s) as pre-certified records. In all be maintained on multiple media types and in multiple 

cases, certification information and "permanent" storage physical and logical locations, (see FIG. 3, blocks 19A 

location is updated to the central ILM database 13, which is through 19F and FIG. 6, blocks 19C through 31). The system 

the vehicle for most system reporting functions (block 15). 20 will track the record type, record format, location, dataset 

When the record is certified and certification information name, volume identifier, as well as specific index 

is written, pre-certification information (written by the ILM information, security level and retention/destruction data, 

capture process to a database file) is deleted from the system. The system will allow the automated maintenance of 

A record of all certification activity is also written to audit approved records retention schedules, including the ability 

file 9, and audit reporting (block 15) can be done utilizing 25 for the System AdminisU^ator to make global modifications 

audit file information. to retention data to all records for record types where policy 

For processed information not automatically handled by or external reasons cause a modification to retention criteria 

the verification/certification function, a Records Manager 25 (see FIG. 4, blodc 13). This inchides the ability to su^end 

(FIG. 4) performs a Quality Assurance review, as part of the and resume scheduled retention for specific information in 

verification/certification process, whidi checks the appro- 30 response to legal, regulatory or other needs or requirements, 

priateness of the record for archival and determines the Records to be managed under this method and system 

recording media, and volume, where applicable, for storage. result from transactions initiated and completed through 

The goal is to provide storage of records with similar various electronic vehicles generating industry standard 

retention periods on the same volume and thereby expedite record formats, which may include some of the following: 

the destruction process. Certain large record types (such as 35 (1) scanned input, including scanned documents, 

direct digital input) may be specifically stored on media photographs, blueprints. X-rays, etc. filed and retained as 

(such as Write Once Read Many, or WORM, platters) and images or microfilm/microfiche records converted to image 

volumes retained for those records. format; (2) electronic mail, including incoming, internal and 

The Records Manager has the option to commit the record outgoing messages filed and retained as part of an organi- 

or file for archival in ILM database 13, to delete the record 40 zation's transactions; (3) facsimiles, including electronic 

or file from the system as inappropriate or erroneous or to facsimile information; (4) voice, including voice messages 

place the record or file on "Hold" in hold area 4 for a captured as incoming telephone trafiBc, voice annotation 

specified period to resolve questions, after which the record related to specific organizational transactions obtained 

will be deleted or committed. Committed records will enter through audio capture or speech recognition, interactive 

the archival process and be stored to allow retrieval until the 45 voice input (e.g. interactive telephone ordering systems) 

selected or system-calculated destruction date. containing both voice and pulse input; (5) video, including 

The Records Manager will utilize the method and system data captured as digitized video images; (6) text, including 

to ensure the retention of all record formats and appropriate text files relating to completed transactions and resulting 

destruction of all logically related records and record ver- from word processing files, optical character recognition 

sions. The system will provide the Records Manager with a 50 output, document recognition system output, conversion 

catalogue of records scheduled for destruction, (see FIG. 5, from voice input captured through speech recognition, or 

block 49), with file/case/folder/dataset name, logical and computer business application output; (7) electronic data 

physical localion(s), destruction date, record format and type interchange (EDI), including EDI data streams retained as 

and related information. The system will also check the trading partner transaction records; (8) output from com- 

scheduled record type and retention period for those records 55 puter application systems* including records of completed 

against the currently authorized retention schedule and transactions (e.g. closed claims), periodic financial reports, 

report discrepancies which the system has not previously employee records, etc. generated from hardware/software 

detected. platforms including personal computer/local (or wide) area 

The Records Manager will determine whether to modify network (conventional wire, fiber optic or wireless), mid- 
retention information or to destroy scheduled records, (see 60 range computing platforms, mainframe computing plat- 
FIG. 5, block 26, 27 and 28). During the destruction process, forms; and (9) direct digital input, including computer aided 
the system will produce a destruction verification log for tomography (CAT scans), magnetic resonance imaging 
certification of record erasure and reindexing of volumes (MRls), computer-generated holograms, digital packet data 
where not all records were erased/destroyed due to extended received through cellular transmission, etc. 
retention periods. 65 The system can also be used to track the location, record 

System links to all involved processing platforms will type, destmctbn date and case-specific information for 

ensure that all new backups are taken and system dataset non-electronic records and manage the retention, retrieval 



05/26/2004, EAST Version: 1.4.1 



5,813,009 

17 18 

and destruction of these records, including microfilm/ retrieval and reconciliation of retention periods and other 

microfiche (not converted to image format) and paper information, to ensure simultaneous destruction of all record 

records, whether stored on-site or in off-site archive facili- versions. 

ties. Individuals with sufGcient system access may view the 

FIG. 4 illustrates the verification/certification function in 5 archive catalogue 25 (FIG. 3) and request retrieval of 

detail. As shown in the figure, Records Manager 25 receives archived data. The system will verify access authority to 

input for verification and certification from multiple sources, requested information prior to retrieval, 

which includes messages coming from information filter 3, Routing of archived information will be managed by the 

and record data units such as held records which have been system depending upon the record format requested. Audio, 

placed in hold area 4 by the information filter or previously lo video, image, textual or facsimile information will be routed 

by Records Manager 25. Records Manager 25 also receives to the workstation 7 of an authorized requester and placed in 

manual tracking data 23 for information not controlled a queue for local access. Large application data files, EDI 

directly by the system which must be entered and tracked for data streams, etc. will be routed to the appropriate location/ 

eventual disposal of the off-system information (from off- CPU (see FIG. 3, blocks 5A through 5E) with header 

site electronic storage 17 and paper records 18 shown in 15 information concerning the request (requester, date, time) 

FIG. 1). In addition, the Records Manager receives data for processing by the business application, data file 

processing exceptioos 24 from business applications 5. searching, etc. 

Records Manager 25 also utilizes information from audit All retrieval requests will be logged, and requests without 

file 9 and retention and related data stored on ILM database necessary authority will be routed to a system user with 

13 during the process. System reports are created from data 20 authority for system administration for exception handling, 

on both audit file 9 and ILM database 13. During this The System Administrator 26 (FIG. 3) has the choice of 

process, Records Manager 25 may enter required infonna- approving or denying the request for information and rout- 

tion about the data record units being certified or about data ing the information to an appropriate receiving agency, 

record units outside the direct contiol of the system (i.e., in FIG. 3 shows the information retrieval process in more 

storage areas 17 and 18), commit or certify the record data 25 detail. In the figure, retrieval requests for record data units 

units, place the records on hold status in hold area 4 or delete of information are sent from an authorized user workstation 

records firom the system due to error conditions. 7 of the records management system. These information 

Data record units processed by business applications 5, requests are passed to the system security module 20 which 

and backups taken by backup module 8 of these files, are determines the user's access rights to the information, 

stored on storage media 19. Location and version informa- 30 Authorized users may request information after viewing the 

tion concerning these data record units is captured by ILM archive catalog 25, which is part of the central ILM database 

capture module 11 and updated to ILM database 13 during 13. Requests which pass security validation are routed to 

the automatic certification of the previously stored informa- ILM database 13 for location information. The system then 

tioD. Where copies of the information created by the busi- routes the retrieval request to the appropriate storage media 

ness applications 5 have been sent outside of the enterprise, 35 19A through 19E to obtain a copy of the requested record 

this information will also be updated to the ILM database data unit(s). Access information is updated on the ILM 

during the automatic certification process. Processed infor- database access log 41, and the system determines the 

mation for which no exception conditions are noted need not appropriate routing for the information (block 24), i.e., 

be handled by the Records Manager 25 during this process. sending the data to a user workstation 7, business application 

System Access/Information Retrieval (FIG. 3) 40 5A through 5D or to an accessible location on network 

Information stored within, and controlled by, the present storage 5£. All information concerning access to record data 

system may be requested for retrieval, viewing or other units controlled by the ILM system is available from the 

processing by authorized users of the system. All such system reporting fimction (block 15). 

requests will be processed by the system to determine the Retrieval is the most used function and allows system 

level of security access authority of the requesting user, in 45 users to select and recall case files or selected contents using 

addition to determining a viable vehicle for viewing or using any of the defined case level and sub-document level index 

the information (e.g., sending copies of the requested infor- criteria, quick search characters (e.g., the first letter of a 

mation to the user workstation, to network storage, to an word) or '^wild cards" (special characters used to represent 

application program, etc.). character strings), with numerous defined search types (any 

The purpose of the retrieval function is to provide access 50 part matching, all parts must match, etc.). 

to stored information to system users within the enterprise in This function allows all users to obtain instant access to 

a manner consistent with the requirements imposed by the the same file or documents without searching for hard copy 

type, format and size of the requested information, as well files or creating unnecessary duplicates of records. Retrieved 

as the information access needs and procedures of the images or electronic files are copied to the workstation for 

enterprise. 55 local decompression (images) and viewing, annotation 

All individuals with access to the system will have (images), printing (images) or making a working copy 

security level access information in their individual profiles, (electronic files). Such copies are resident on the woiksta- 

(see FIG. 3, block 20) which will extend or limit access to, tion fijted disk only until closed within the session or until 

and duplication of, the various records and record types the end of the session, when the copies are deleted from the 

managed by the system. Where paper hard copy records 60 woikstation. System users in separate geographic locations 

and/or microfilm or microfiche are also managed through may view and annotate the same file, requiring only a screen 

this process, the system will track the on-site location or refresh to view one another's annotation information, 

warehouse where the records are stored, as well as the Retrieval also allows authorized users access to related 

warehouse location or on-site file drawer, for ease of indicators and information in the form of annotations (line 

retrieval from any location. 65 drawing, highlighting, electronic "sticky notes" or margin 

The ILM database includes information concerning logi- conunents), any icon "bullet" status indicators which have 

cally related records, their locations and retention data for been attached to cases or individual images with a descrip- 
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tive message and any case *^journar entries which have been The following system utilities may be called from within 

created by individuals and attadied to case files. These the retrieval function: (1) Send a Message (which allows a 

joumal entries may be either public to authorized system user to send a message to the specific user workstation or to 

users or private to the author and may have diary "tickler" a general message queue for workgroup access); (2) Save a 

dates attached which generate reminder messages to the 5 File (allows the authorized user to make a "working copy" 

author in their workstation message queue at the appropriate ^ saved electronic or image file and export it from the 

date. Case journals are useful for maintaining on-line diaries system; (3) Send Fax (allows the user to fax imaged infor- 

of case-related information. Jotirnal entries may be edited or ^^^^^^^ ^irecUy to an external facsimile modem or machine); 

deleted only by the author or the Records Manager. (4) p^^^^ (^y^^s ^^^^^^ ^ ^Idere, 

Persons wishing to review imaged (or other electronic) ^^^^.^^s or sub-documents to a defined local or network 

mformation are allowed to select a portion ofa case or folder - . \ rcwr xm / n . «u • 

(specific documents or subnlocuiients) diat they wish to P^.^^^?' ^^^^ ^^'^^ (^"^^^ ^ ^V/If c I 

viw before images or files are retrieved for local viewing at "^dividual message queue at any time); and (6) Search 

the workstation. TTiis lessens image traffic on the network (^^^^s a report to be generated of cases which meet one or 

and improves overall system performance. search cntena-either within a case type or across aU case 

In one implementation of the present invention, retrieval types), 

features are accessed through "point and click" on the Where so configured, the retrieval function is under the 

ToolBox and ToolBar command utilities or by using speed control of a specific user message queue when the user logs 

keys or pull-down menus. Images or non-image files may be on to the system and selects the retrieval function. The 

viewed in single-page (one page at a time) mode or in system will present the message queue only if outstanding 

dual-page (two pages side by side) mode. Non-image files 20 messages are present. Messages, once read, are deleted from 

are viewed by using scroll bars to navigate through the the system to help ensure that unnecessary, transient infor- 

document. Options to assist a user in scrolling through mation is not saved. Messages may have the case identifier 

documents once retrieved to the workstation include: (1) ofstored case files aUached, in which case the user may elide 

clicking on sub-documents and pages within sub-documents on the identifier and go directly into a case contents dialog 

from a navigational box on the Toolbox; (2) the use of speed 25 for that case, which allows the user to select that portion(s) 

keys such as the up and down arrow keys, pageup and of the case (or the case itself) that he wants to retrieve for 

pagedownkeys, end key, etc.; and (3) utilizing a "case scan" viewing. When a message is sent, the sender may set a 

function which, at a user-selectable speed, allows the scroll- priority (1 to 99) for the message, which will determine the 

ing through of images and files in either single or dual-page display order of the message in the message queue 

mode and a stop button to cease the scan when the desired 30 (messages with the same priority level will be displayed 

page or file is reached. Multiple cases may be open on the within priority in the order received). The system will poll 

workstation at any one time. Pages from multiple cases for user messages on a user-selected basis (e.g., every 

retrieved to the workstation can be viewed in a "side by minute to an hour). When the system identifies a newly 

side" mode for comparison of contents. received message, a user message is sent and the user may 

Case journals may be accessed by authorized users from 35 elect whether or not to view the message immediately, 

within the retrieval function or from the menu. Case-level The retrieval module accesses the ILM database, which 

index criteria may be edited from within the retrieval contains pointers to the physical storage location of the 

function. image(s) or electronic files to be retrieved. Image copies are 

Options available to manipulate imaged information once retrieved from the image server and sent in compressed form 

retrieved to the workstation include: (1) Zoom (sizable 40 over the network and then decompressed by the software 

window showing selected portion of image or user-defined portion of the imaging engine for display at the requesting 

variable window showing document over entire viewing workstation. Electronic (non-image) files are not com- 

screen); (2) Rotate (reposition image at 90 or 180 degree pressed for storage. The images or files are optionally 

intervals; all annotations currentiy saved with the image are encrypted for enhanced security, 

also repositioned accordingly); (3) Landscape (display 45 Disposal of Records 

image in landscape format and save landscape position for Certified information, maintained within the system, is 

further viewing by all system users after session is com- held for periods of time (or other retention parameters, 

pleted; when images are placed in landscape, any annota- which may include retention by source, by destination, by 

tions attached in portrait mode will be repositioned data usage, etc.), based upon the approved retention sched- 

accordingly); (4) Aimotations (overlay, edit and delete high- 50 ules and other criteria (e.g., system backup schedules) of the 

light or drawn line annotations; electronic "sticky notes'*, enterprise. 

which are text entries that close to an icon which may be For some records, retention information may be incoming 
positioned anywhere on the displayed image; margin with the record or retention may be assigned to the record 
comments, which are text entries within an open window, (e.g., information created at a system user workstation) 
which may be positioned anywhere on the displayed image; 55 when it is sent for verification/certification, 
and 'l3ullets", icons which attach to an image and which may At the end of the retention period (or version cycle, etc.), 
have the bullet name overlaid as text on the image when except in those cases where information is so flagged or 
displayed (e.g., "canceled")); (5) Case Scan (allows the user where retention has been su^ended due to legal action, 
to page through retrieved images or electronic files at a regulatory proceeding, etc., the system will electronically 
selectable speed and stop when the desired page or file is 60 purge the retained information firom all necessary storage 
presented for viewing); and (6) Image Tagging (allows locations across all affected hardware and software plat- 
electronic "paper clipping" of a subset of retrieved images to forms. The purpose of the disposal function is to maintain 
create a dynamic file for working at the workstation. This the smallest possible subset of validated information 
paper clipping, or tagging, feature allows navigation through required to manage the business of the enterprise, 
all retrieved information or only tagged information). These 65 The present system provides an automated method of 
features do not impact upon the integrity of stored informa- tracking the retention of stored records and a purge feature 
tion. which provides for the complete disposal of records at the 
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end of the retention period. While other systems dispose of 
database information and stored pointers, the present system 
completely purges the file and ail associated records and 
images, even those stored in cabinets or residing on perma- 
nent (Write Once Read Many, or WORM) media. 

During disposal of stored records, the system will purge 
records from storage media 19, directly controlled by the 
system, and send a purge request for electronic or paper 
records stored oflf-site (at off-site electronic storage 17 or in 
paper records 18) or not within the direct control of the 
system, including backup copies stored for recovery pur- 
poses. Such requests will cause data concerning the record 
data unit of information to be retained within the system 
until the Records Manager or authorized individual certifies 
that the records have been destroyed. 

Also, during the disposal process, the system will log all 
puige activity to ILM database 13 and audit file 9; delete all 
active pointers and other related information from ILM 
database 13 and other affected databases; and where 
required, initiate a new backup process via backup module 
8 to create files without purged records. The system also will 
send appropriate commands (JCL, etc.) to a_ffected platform 
system catalogues 16 to synchronize dataset versions. 
Reports of all results of the (tisposal fiinctions are obtained 
from the system reporting function (block 15) or &om 
information contained in ILM database 13. Reports contain- 
ing related audit information (block 15) may also be 
obtained from audit file 9. 

Once disposal is completed, recovery of purged items 
which were deleted in error is only available from a saved 
backup of the system. All files and documents which are 
purged using this function are logged, providing proof that 
destruction was done in the "normal course of business" 
according to established procedures. 

Disposal of images and files is facilitated by allowing 
authorized individual(s) to select a file type (or all types) and 
to build a list of all documents within the, system whose 
disposal date is equal or prior to the current date. When the 
list is built, all documents (except those carrying a "Do Not 
Delete" flag, which prevents purging from the system until 
the flag is removed) are automatically selected for disposal. 

The authorized user may de-select a document or file and 
remove it from the normal disposal process, if this is desired. 
When this is done, the document will not be purged during 
the disposal process. 

The system allows an authorized user to modify retention 
information for items not purged in the disposal process or 
to retain the original disposal date. Where the retention 
information for those items is subsequently modified 
through the '^recertification" process, a reason for the change 
must be entered into the database by the Records Manager. 
When the disposal date is not modified for items not purged, 
these items will present themselves in all subsequent dis- 
posals (for that case type) until the items are purged. 

FIG. 5 illustrates the disposal function in detail. Referring 
to the figure, disposal of records is initiated by Records 
Manager 25 at defined intervals. Records Manager 25 may 
choose to destroy a set of record data units, to exempt the 
records from disposal and/or to modify the retention infor- 
mation. Where retention is modified, the record data imits 
are fed to a reindexing function 29 where retention data is 
updated. The new retention data is updated to the ILM 
database 13 and the reindexing activity is also reflected in 
audit file 9. 

Where the decision made is that records are to be purged 
(block 28), the system (block 30) purges the record data 
units from storage media 19 controlled by the system and 
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removes all related data from ILM database 13. The system 
also records the purge activity to the ILM database and logs 
the activity to audit file 9. 
Purge requests are initiated for records 17 stored off-site 

5 and for paper-based records 18. When notification is 
received that off-site and paper records have been destroyed, 
the Records Manager will update ILM database 13 and the 
activity will be logged to the audit file 9. After a purge is 
completed, the system will initiate a new backup process 

10 (via backup module 8) and affected system catalogues 16 
will be synchronized to reflect the new version information. 

When disposal occurs for records which are stored on 
permanent media (e.g., WORM platters), special handling is 
required to remove the stored sub>documents from the 

15 system. In accordance with this process, sub-documents 
stored on permanent media are removed by first creating a 
temporary database table for all permanent (WORM) vol- 
umes which have sub-documents to be disposed, and veri- 
fying the path to that volume. Sub-documents to be removed 

20 fi-om the permanent media are grouped on temporary data- 
base tables by platter (e.g., WORMOl, WORM02, etc.). A 
check is then made to determine whether any of the sub- 
documents to be disposed is logically attached to another 
document or folder with a longer retention. If so, the 

25 document cannot be purged from the system. 

Next, the contents of each affected platter are dumped to 
rewritable media (after the system has determined that 
sufiGcient storage capacity exists on the rewritable media). 
The records to be destroyed are then purged from the 

30 rewritable media (e.g. platter). After each affected perma- 
nent platter's contents are dumped to rewritable media, a 
system message is sent to the System Administrator to 
dismount and destroy the permanent platter. After each 
dismount, a system message is sent to the System Admin- 

35 tstrator to mount a new platter, which has been initialized 
with the same volume name and to which remaining platter 
contents are written after the system checks to verify that the 
volume name equals the volume identifier of the destroyed 
platter. If there are no remaining records to be written to the 

40 new volume, the mount message for the new volume will not 
be sent and the next platter to be purged will be mounted. 

After all records are deleted from each rewritable 
medium, all associated database records related to that 
sub-document are purged from the database. In instances 

45 where all sub-documents (or all remaining sub-documents) 
in a case are being destroyed during the disposal process, all 
case-related information is purged from the database tables. 
The exception to this is where outstanding information 
exists concerning off-system sub-document versions which 

50 must be destroyed as part of the disposition process. When 
information is deleted from the database, as the transaction 
is committed, the table is overwritten. 

This process continues until all affected permanent media 
has been rewritten with records not yet due for disposal. 

55 After the permanent media disposal is completed, the system 
deletes all selected images or electronic records and asso- 
ciated database information stored on rewritable media, 
making the space available for storage of other information. 
Deletion of images or electronic files and SQL database 

60 inforroaion for those files is done on a one-for-one basis for 
images and electronic records stored on rewritable media. 
All records purged from the system are logged for audit 
purposes as the files are deleted from the temporary media 
and reports concerning disposition are available from the 

65 system. 

Another method of purging records stored on permanent 
media involves building the temporary database table for all 
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WORM plattets with contents to be disposed and verifying If the request for infoimation is rejected during the 

the path to the volume. Sub-documents to be removed from card/terminal operation, the access card bolder will receive 

each platter are then grouped by platter and a check is made a "Not Authorized" message, and the invalid access attempt 

to determine whether any of the documents to be disposed will be updated on the access card database. If a sufficient 

are logically attached to a document, folder or case with a 5 number of invalid access attempts are made using any single 

longer retention. If so, the sub-document cannot be disposed card, the card will also be invalidated for access until a 

of during the process. revalidation routine is performed on the card by an autho- 

After the contents of each permanent platter have been agency, 

checked, the records to be saved are written to temporary When a previously validated access request is received in 

storage and a check is made to ensure that only records to be 10 archival facility, a system terminal at the facility will 

retained have been written. A message is then sent to the display the identity of the requester, the requesting 

operator to remove and destroy the platter and to mount a organization, the records requested, media and location, as 

new WORM platter in its place. The contents of each ^^^^ ^ desired mechanism for forwarding the informa- 

WORM platter which are to be retained after the disposal (on-line transmission, courier, etc.) to the requester, 

process are then rewritten to a new WORM platter. 15 ^^^^ transmitted by the facility to client sites may be 

encrypted as part of the transmission process. One or more 

Centralized Automated Records Archival encryption keys will be made available to cUents for data 

Anotherimplementationof the present invention involves decryption prior to reading or processing at the client 

an automated "warehouse" facility for paper and electronic location. The decryption process will be undertaken by an 

records. Such a facility can be accessed on-line from exter- authorized individual at the client site, 

nal organizations and provides for the automated transfer of An archival facility database will track requesters and 

requested information stored on behalf of the external enti- data requests, along with archived records, media and loca- 

ties. tions. This information will periodically be fed through a 

From time to time, organizations audit records stored neural network system which will assist in the management 

off-site in warehouse facilities, such as facilities managed by 25 of record archival media and location for ease of access and 

Pierce Archives. Although the number of "lost" paper forwarding. 

records may not be significant in relation to the number of As requested by its clients, the facility will arrange with 

records stored at the facility, some number of boxes of an outside vendor(s) to do conversion of paper records or 

records are generally lost or misfiled due to the manual microfilm or fiche to optically-stored images. In addition, 

nature of the storage procedures used in most such facilities. 3Q records retention information for those images may be added 

Also, many current archival facilities which are well- at the facility upon request. 

organized, clean and climate-conU"olled for proper storage Pierce Archives, for example, offers, as part of its service 

conditions are mainly for "dead" storage. Such facilities to customers, an on-line system to allow a customer to 

cannot handle a significant volume of recall/drop-oflD' review records archived, box locations, make record 

delivery requests, such as those generated by large organi- 35 retrieval and destmction requests and allow ordering of 

zations or entities. Other facilities which ate less organized record cartons. This service, accessible from a stand-alone 

and controlled for proper archival of records are better microprocessor or personal computer, supplements monthly 

staffed to handle volume drop-ofl&'recall requests. activity reports sent by Pierce to warehouse clients. The 

Using the ILM system according to the present invention, automated facility according to the present invention pro- 

an automated archival facility for paper and electronic 40 vides the following additional services: (1) added security 

records is the "next generation" of archival storage and through remote access key validation prior to contact with 

provides for storage of retained paper documents and the archival facility; (2) management of electronic informa- 

microfilm/microfiche as well as records stored in electronic tion across all formats and media, in addition to storage and 

formats. The present invention can be utilized by organiza- management of paper and microform records; (3) capability 

tions whose records archival needs are more active than 45 of providing a total records management solution, not just 

"dead" (i.e., record recall requests will be frequent enough archival warehousing of records; (4) capability of providing, 

to warrant on-line access to the archival facility). through business relationships, document/ microform con- 

A facility according to the present invention will handle version and index and records management information 

an organization's total requirements for records manage- entry; (5) multiple retrieval options, including electronic 

ment (active and dead storage). The facility is accessible 50 transfer of information to a requesting customer; and (6) 

through an on-line system, which will validate and process active, continuous, physical archival management, utilizing 

requests for archived information and forward requested technology (e.g., neural network monitoring of data/paper 

data electronically or by other physical means to the request- access frequency) to optimize record locations (e.g., change 

ing organization. jukebox platter locations or move physical records to more 

Due to the sensitive naUire of information stored in this S5 accessible locations) and facilitate retrieval, 
facility, on-line requests can be made, through a system The archival facility, according to the present invention, 
terminal in the requester's own facility, only after a smart will also provide a solution to the following problems 
card or other access key is properly placed into the terminal experienced with current records archival companies: (1) 
receptor. This access key for example, will perform the inaccurate inventory of archived record carton^ (2) time- 
following functions: (1) turn on the terminal and attached 60 consimiing and costly research process required to locate old 
microcomputer; (2) validate that the request for archived records due to lade of itemized knowledjge of carton con- 
information is within the bearer's archival access authority tents; (3) lack of follow-up tracking or information available 
(contained on the card); (3) update the card database with the on records recalled from archival, including up-to-date 
information access request; (4) establish a telecommunica- retention and destruction schedule data; (4) time delays in 
tions link with the archival facility; and (5) send information 65 recalling archived information from the off-site facility; and 
concerning the information access request to the archival (5) inability to manage all business records through a single 
facility. system. 
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Although these issues are less important for organizations Certified records may then be requested by a second 

whose archived records are "dead" (i.e. seldom if ever branch location retrieval workstation 13. In response to the 

recalled), previous Records Management studies have request, images are routed from file server 8 to a router 9 and 

shown that at least 25% of inactive paper records, for into the Wide Area Network 3. The images are received via 

example, are recalled on a regular basis. 5 a router 11 at the branch location and routed to the Local 

Area Network 12 for passing to retrieval workstation 13 for 

ILM System Remote Operation with SmartCards viewing. 

Referring to HG. 6. an alternative method of implement- ^ piling Structure for Paper-Based 

ing the ILM system will now be described. Information 

In this figure, the ILM system is used to run a remote 

information archival application, which houses information ^1^. 8 represents a sample filing structure which may be 

belonging to multiple organizations and is accessed by used for filing, storage and retrieval of paper-based (scanned 

authorized representatives of those organizations through a images) documents or electronic documents (e.g., 

retrieval station 7 containing a smart card reader. Authorized spreadsheets, word processing files, etc.) which are gener- 

individuals wishing to request access to stored information ^^^X handled for filing and retrieval in the same manner as 

from the archival facility place their smartcard access key 36 paper-based files are handled. 

in the reader in their organization. The card turns on the The elements of this structure include a cabinet 42, which 

terminal 7, validates the card bearer's access authority from represents a physical storage location; a case type 43, which 

the card access database 20, updates the information 20 represents a type of file, such as a claim or a contract; cases 

retrieval request on the card database 38; establishes a 44, which represent specific instances of the case type, such 

communications link with the archival facility; and sends as specific claims or contract files; folders 45, which repre- 

data concerning the information request to the archival sent logical filing units within the cases; documents 46, 

facility. which represent individual documents (or groups of records) 

Information requests not within the card bearer's author- 25 ^^"^ folders; and sub-documents 47, a further 

ity wiU receive a "not authorized" message and the invalid definition and breakdown of information stored within docu- 

access attempt wiU be updated (block 39) to card database ^^^nts. The last unit of case-based files is the page 48, which 

3g represents a specific scanned image or electronic record. 

VaUd retrieval requests will be touted to the terming 7 at ^nf^^^ti """"P'"' " 'fi?"^.''"^ 

the archival facilit7and will display the requester, request- 30 ^^^^ "amp « file structure mimics a paper file stored 

.J J J- J 1 ^« Within a separate folder, 

mg organization, requested records, media and location, as ^ 

well as forwarding information (on-line transmission, q^^^^ ^^^^^ Features 
courier, etc.). 

Retrieval request information wiU be written to an access/ The ILM system of the present invention is an integrated 

retrieval database 41. T^e system will query ILM database ^5 tool which combines the features of an electronic document 

13, which will route the retrieval request to the appropriate management system with true Records Management capa- 

storage media (18, 31, 19). Periodically, request and location ^"^^y sensitivity to and support for the issues of the legal 

database information will be fed through a neutral network admissibility and discoverabUUy of records and electronic 

system 36, which will determine the most viable location for records-related regulatory compliance issues through built- 

information and media storage (based upon frequency of ^0 m system features. These and other umque features of the 

access, etc.) for ease of retrieval and update the consoUda- P^^sent apphcation which distinguish the system from other 

tion database 37 accordingly. available products are now explamed m some detaU. 

_ , . ^ J . *L * • r 1-1 c » Automated Support for Legal Admissibility of Stored 

Data to be transmitted to the requester IS, preferably, first Records & ^ 

encrypted and an encryption key 34 is attached to allow for System Inteeritv 

decryption at tte receiving location .j^^ system of the present invemion is a self-checking 

fonvaided to the requestor s waitmg busmess applications ^^^^^ ^ ^ ^ 

(5A,5B,5E^,toasUnd.aloneretri^^ ^^^^ ^^^^ 

faxed te a specified number (32) or sent by courier (33), if ^^^^ ^^^.^^ ^^^^^^ ^^^.^^^^ ^ ^^^^^^ .^^^^^^^ ^ J 

reques . checking the status of that user's workstation (hard 

Sample System Configuration Showing an ^^^^^ ^^^^ ^^^^^^^ comiection) as well as the network 

Enterprise Implementation with Branch and Central P"°^^.^^ ^^^^^^ servers^ optical storage devices and data- 

Corporate Locations mtegrity. A status dialog box on the screen shows the 

progress of the system self-check to the workstation user. 

Referring to FIG. 7, there is shown another exemplary S5 Results of this test are returned and logged to a table on the 

system configuration. In this sample implementation, docu- database. This built-in diagnostic provides the answer to the 

ments are scanned into the system by a scan workstation in customary admissibility question, "How do you know that 

a branch location and sent (see arrow 1) to temporary storage the system which produced these records was working 

where the documents are saved. The information is passed, properly?" 

through a router 2 located at the branch location, to the Wide 60 The System Integrity function can also be run by autho- 

Area Network 3. The information is received at a router 4 in rized system users from the Main Menu at any time. This 

the corporate office and stored temporarily on a file server, function provides a printed record of the integrity check 

which may be a Novell file server. At the corporate office the results, 

records are recalled from the file server 8 by a management Audit Logging 

woricstation 6 connected to a local area network ring 7 and 65 All significant functions performed on tl^ present system 

routed via routers 10 and 4 to the management workstation are logged for audit purposes to tables on the database, with 

for certification. such information as the login ID and workstation of the user 
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performing the ftindion and the date and time the function imaged documents or the export copying of electronic files 

was performed. In addition, no record deletions or modifi- stored within the system. In the last two instances, the 

cations to the retention data of stored records may be location is recorded automatically by the system to a Media 

performed without first indicating the reason for the deletion Locations table. When stored system records are backed up 

or change. The reasons are also written to the audit log file. 5 for recovery purposes, information concerning the backup is 

All records printed by the system are logged, with the ID written to a Backup Log. 

and workstation ID of the individual who printed the record For other copies or duplicates of the sub-document not 

and the date and time the print was done. This extensive created through the system, the Records Manager may enter 

logging is useful for troubleshooting and activity verifica- the information into the Media Locations table for tracking, 

tion. More importantly, the logging may also be valuable in lO The system tracks both the media on which the sub- 

the event it becomes necessary to prove to a court of law or document is stored and the physical location of that record, 

regulatory body that some activity did not occur (records This is done to facilitate the simultaneous (manual) destruc- 

may be used to prove the negative as well as the positive). tion of all outstanding copies of the sub-document at the end 

In addition, back-up support for any deletion of records of the retention period. 

"outside the normal course of business" (which may raise a 15 When the disposal process is performed, it is necessary to 

flag if discovered during litigation or pre-trial discovery) is run a new full backup of both the database and stored image 

noted within the system itself. and electronic files and to dispose of prior backups to ensure 

System Audit Function continuing integrity of scheduled retention information. 

TTie System Services portion of the present invention After the disposal process, the prior backup is maintained 

contains a feature which allows an external individual(s) to 20 only until it can be verified that no records were purged in 

audit stored files (image and non-image records) by building error. 

a list of files in one or all case types and selecting individual The electronic record export facility allows an authorized 

files, folders, documents, sub-documents and pages to view system user to create a copy of the stored file and import it 

in the Audit function viewing window. In addition to the into an appUcation for modification. The present system will 

images or electronic files, the auditor may view all index and 25 not launch that application (to prevent accidental overwrit- 

retention period information and determine whether anno- ing of previously certified information) and requires that any 

tations have been added to the individual sub-document other "versions" of the electronic records be separately 

page(s). saved and certified into the system. This allows the reuse of 

After viewing, the auditor may place a Pass or Fail flag on electronic documents or records without compromising 

the sub-document, which will cause a Last Audited date field 30 information stored within the system, 

to be filled by the system. This date is used to verify that an The present invention may be implemented in accordance 

audit has occurred and also to select cases and sub- with any suitable programming language and run on any 

documents for the next audit pass. Closer scrutiny of operating system. The operating environment for controlling 

selected cases may be done by noting the selected files and the storage of images and electronic files may be Novell 

viewing them using the retrieval function prior to setting the 35 Netware (Token Ring or Ethernet), or Windows NT. For a 

audit flag indicator. Cases for audit may be selected through current Microsoft Windows NT implementation, an inter- 

a reference to the Last Audited date field (e.g., select all face ("thunking") layer handles the 16 bit to 32 bit conver- 

cases not audited since . . . ). sion of calls and parameters. Other implementations can 

This feature provides the organization with an automated include OS/2 and Unix, 

manner in which to periodically inspect its electronic 40 Four or more main functions and a number of utilities are 

records and provides an answer to the admissibility ques- accessible through a Main Menu. The Main Menu contains 

tion: "How often is the system which produced these records icons for all functions and utilities available and "bubble 

audited?" since it can be shown that business records are help" for each icon to assist the user in navigating beyond 

consistently checked for accuracy and that established pro- the menu. Functions and utilities not accessible to a specific 

cedures are consistently followed by system users. The 45 system user are disabled at the Menu screen when the user 

system reports function provides several pre-defined audit signs on to the system. The main functions are further 

reports for use by the system auditor. Specific audit criteria described as follows: 

for each organization are developed within that organization Scan and Index 

to conform to internal policies and procedures. This is a restricted access function which allows a user to 

Electronic Document Import/Export 50 enter information into the system through a number of 

Electronic documents, other than scanned images (e.g., industry -standard scanner devices, which interface to the 

electronic mail messages, facsimiles, word processing scan function through the Kofax imaging engine, 

documents), may be imported into the present system, from A Kofax board (and software) is installed in any work- 

a user workstation using the Import Utility and saved as part station utilizing the scan function. This board provides 

of an ofGcial business record within a system file. Although 55 connectivity with the scanner device and handles image 

these documents remain in modifiable format and can be compression and decompression. Kofax is considered an 

copied for export out of the system, they may not be industry standard imaging vendor. The present system 

modified from within the application and none of the origi- incorporates, insofar as possible, industry standard hardware 

Dating {^plications (e.g., Excel) can be launched by the and software components coupled with its own proprietary 

present system. This helps ensure the integrity of saved file 60 application. 

contents. The ability to make working copies of saved For case files to be stored within the system, the user may 

electronic files is limited to specific system users through attach appropriate index information (search criteria) to 

system security. imaged cases and sub-documents, organize documents for 

Version, Media and Duplicate Management formal filing and retrieval and save the images to a tempo- 

The present sy^em provides for the tracking of sub- 6S rary network storage device, 

documents which have off-system duplicates or for which These images may be placed into a newly-created local 

off-system duplicates have been created through printing of filing imit (i.e., case) or appended to existing information 
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within the system. Images are compressed by the imaging 
engine prior to saving on network storage to minimize 
impact on network traffic and file server storage. The system 
may be placed for scanning in automatic system mode, 
which creates or retrieves case information and scans docu- 
ments into the created or retrieved case, or in step by step 
mode, which requires the scannist to scan first and then 
process case inforaiation in a strictly controlled sequence of 
events. 

Through this function, the scannist may toggle to an 
"in-bound queue", allowing the scannist to index and place 
(file) uncertified electronic documents or files that have not 
been scanned but are incoming by means of being placed 
into the Import Utility by authorized individuals. Such 
"documents" include, among others, facsimiles, electronic 
mail messages, spreadsheets, word processing files and other 
ASCII files. These documents may be viewed by means of 
a generic viewing utility, organized and filed together with 
imaged documents in appropriate case files. 

Documents may be scanned in black and white or in color 
into the system on a case basis or batched with separator 
sheets for high-speed scanning and handling of batches. The 
system allows saving of batched pages on network storage 
to allow for separation of scanning and indexing functions. 
All functions of the selected scanner, including resolution 
setting and halting the scan process if necessary, are con- 
trolled through the application itself and do not require 
physical manipulation of the scanner device. 

Documents incorrectly scanned (e.g., folded or bent) or 
improperly (unnecessarily) scanned may be deleted prior to 
the save process. For indexed files (not saved batches), 
entered search criteria will be updated to the database when 
the case is saved to temporary network storage. For batches, 
only batch infonnation will be saved to the database during 
saving to network storage. 

Landscape documents which have been scanned into the 
system as portrait documents may be flagged as landscape 
for ease of later viewing without the necessity of rotating the 
image(s). The scan function has access to messaging as well 
as the bullet annotation feature of the system. Scan may be 
minimized to allow for simultaneous running of other appli- 
cations. 

Imaged documents are compressed as they are scanned 
into the fixed disk of the scan workstation by the hardware 
portion of the imaging engine. Saved (imaged) documents 
are preferably sent in compressed form over the network and 
stored in temporary storage as compressed images. 

System Services 

This function allows the System Administrator to config- 
ure system options, to handle security, set the database 
backup schedule and to access the pre-defined reports menu. 
System Services is the day-to-day administrative function 
handler for users and contains the system audit function. 
System Services functions include: 
Security: 

Tlie security function allows the System Administrator to 
define user security profiles, which include functional access 
rights and stored information access levels. The user may be 
given access to any or all of the four main system functions 
and the system utilities. Retrieve, Management Services and 
System Services are broken down and access to these 
sub-functions is also given within Security. 

At any time the System Administrator may determine 
what functional access has been granted to a specific user by 
clicking on the Quick Rights button, which produces a 
listing of all system features to which the user has access. 
The access rights for each system user are set up within the 
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Security function, as a security access range (for example, 0 
to 999) which conforms to security levels given to cases, 
folders, documents and sub-documents which are set up 
within the system. The user is assigned a low range and a 
5 high range and is allowed, for example, up to ten range 
exceptions (security classes outside the main access range to 
which the user has access). Case information, cases, folders, 
documents and sub-documents which are not included 
within either the access range or the range exceptions may 
not be retrieved by the specific system user. Associated with 
each user is location information, which defines the portion 
of the organization to which that user bebngis. Tbis feature 
allows the system to be used by the enterprise, whether or 
not the enterprise is defined as a single or multi-company 
organization. 

Passwords are set up within the user profile by the System 
Administrator and must be modified at sign-on by all system 
users on a pre-defined basis (e.g., every 30, 60, 90, etc. 
days). Passwords are encrypted within the system and are 
not viewable at any time (encryption may be based on a DES 

20 algorithm or other algorithm known in the art such as PGE, 
RSA, NIST or the like; for example, the password is 
encrypted twice and the results of that encryption are 
converted to a numeric string). The Login ID is set up within 
the S3^tem to equal the network (e.g., Novell) Login ID and 

25 is never entered by the user during the login process to the 
present system. The system checks the User Table to deter- 
mine that the Login ID which corresponds to the entered 
password equals the Novell Login ID. Where a difference is 
detected, login access to the present system will be denied. 

30 Repeat use of passwords by users of the present system is 
discouraged, as the system tracks the current password and 
the three prior passwords used and will not allow any of 
these passwords to be entered during the password change 
dialog. The use of trivial passwords (e.g., " AAAAAA*^ may 

35 also be prohibited. 
Options: 

Options is divided into the System Audit function 
(previously described) and Configuration Options. Configu- 
ration Options include the set-up of a General Queue for 

40 workgroup messaging and the set-up of outbound faxing for 
selected users with the proper equipment installed at the 
workstation. 
Set Backup Frequency: 
The system allows authorized users to set the date, time 

45 and frequency of database backup. Where no settings are 
made, the system defaults to a backup at 24:00:00 daily. 
Reports: 

The System Administrator is allowed access to a ftiU, 
pre-defined menu of reports. Reports fall into three catego- 

50 ries: Management Reports, which contain information 
required for the Records Manager to handle the Manage- 
ment Services function; Audit Reports, which contain 
reports used by the external or internal audit individual who 
uses the System Audit function; and System Reports, which 

55 include system activity logs and other reports required by 
the System Administrator. Reports are point and click 
(report mns immediately after clicking on the icon next to 
the desired report name) and some reports allow the entry of 
a date range to limit report output. When the report is run, 

60 an on-screen formatted report is immediately created; print- 
ing the report, if desired, is an option. Several navigation 
icons allow the report requester to navigate through the 
pages of the on-screen report. Ad hoc reports may also be 
created using a report utility program. 

65 Management Services 

The Management Services function allows authorized 
individuals to handle all system set-up and processing 
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functions associated with the Records Management portion the Records Manager wishes to modify retention informa- 
of the system, including Records Administration (which tion and so indicates during the disposal dialog. All such 
includes the certification process previously described); Dis- sub-documents are then flagged for recertification and will 
posal; Types (set-up of the case-related filing structure automatically present themselves when the Records Man- 
including cases, folders, documents and sub-documents, 5 ager accesses the recertified mode of Records Administra- 
with associated retention and security class information); tion. The Records Manager may then alter the retention 
Cabinets (defining storage locations and the path informa- information and certify the sub-document(s), after entering 
tion for that location); and Bullets (which allows the a reason for the change for audit purposes. The system will 
Records Manager to define what icon status indicators may recalculate the disposal date based on the newly entered 
be associated with cases stored in the system). Management lo retention information. Whenever the retention information is 
Services contains many unique features of the present inven- modified, the system presents the Records Manager with the 
tion. default retention information and the last entered retention 
Records Administration: for comparison purposes. 

The main function of Records Administration is the When the only information concerning a case in the 
certification of sub-document information to be stored 15 system is information concerning off-system Media Loca- 
within the system and made available for retrieval by tions or when the Records Manager wishes to add or delete 
authorized users. Certification is performed in one of the Media Locations information without the performance over- 
available system modes of Records Administration, i.e., head of retrieving and displaying images or files, the 
uncertified mode. While the images or electronic files are Records Manager may access the "media only" mode of 
uncertified, they are stored in temporary network storage and 20 Records Administration. The same functionality is presented 
are unavailable for retrieval at the, workstation. During in this mode as in certified mode, except that images or 
certification, stored records are moved by the system &om electronic files will not be displayed. When all images or 
temporary storage and placed in their pre-defined permanent electronic files have been purged from the system and all 
location. Also, during certification, the system uses the Media Location information deleted by the Records 
retention period (for example, in months) and the certifica- 25 Manager, all database information will be purged from the 
tion date to calculate the disposal date for sub-documents system after the deletion is logged for audit purposes, 
having date-driven retention. Certification is a quality con- The following utilities are accessible from within the 
trol process performed on most case-related information. Records Administration function: (1) Send Fax; (2) Send A 
Laige numbers of computer-generated records being filed Message; (3) View Message; and (4) Print 
within the application at one time may be sent through as 30 Disposal: 

pre-certified records. This function (described above) may only be accessed by 

After certification, the Records Manager may still work authorized individuals. In brief, its main functions are to: (1) 

with the case file contents by accessing certified mode. In build and finalize disposal lists; (2) verify copied pages/files; 

certified mode, the Records Manager may view index (3) write temporary database tables; (4) purge and rewrite 

information, attached bullets, media locations and retention 35 permanent (WORM) media and associated database data; 

information and has the following available options: (1) (5) purge erasable (DASD or rewritable optical) media and 

delete page or sub-document (a reason must be entered for associated database data; and (6) write, for audit purposes, 

audit purposes); (2) transfer page or sub-document (move a disposal log for all sub-documents, etc. deleted from the 

from one case, folder or sub-document to another, including system. 

movement between storage cabinets); (3) copy page or 40 After this process has been completed, it is necessary to 
sub-document (logically attaches a stored page or sub- manually determine that no records have been purged in 
document to more than one sub-document or document, error and then to complete a new fiill system backup, 
across cases and folders, so that when any of these cases, destroying any prior backups. This will preserve the integ- 
folders or documents are retrieved, the copied page or rity of the disposal process. Sub-documents marked "Do Not 
sub-document will also be retrieved); (4) add/delete media 45 Delete" may not be purged during the disposal function. The 
locations (add or delete references to copies of sub- Records Manager may, however, view any descriptive text 
documents which are stored on media and in locations entered when the marking was attached to the sub- 
outside of direct control of the system to help ensure document. 

complete file disposition of all copies at destruction time); When the Records Manager exits the disposal function 

and (5) modify retention period (change the default retention so and has excepted records from the purge, he will be asked 

information set for the sub-document at the time of oertifi- whether the records are to be recertified. A "yes" answer will 

cation; a reason must be entered for audit purposes). place the excepted sub-documents in the queue for recerti- 

The Records Manager also has the opportunity to rotate fication. 

images as they are displayed. Electronic (non-image) files Types: 

caimot be rotated but may be viewed by using scroll bars. 55 This set-up function allows the Records Manager to create 
Prior to being certified, data streams, sub-documents or within the database the filing structure for the storage of 
uncertified sub-document pages may be placed by the case-related information within the system. Types to be 
Records Manager into Hold status until problems or ques- defined include Cases, Folders, Documents and Sub- 
tions can be resolved and certification or deletion can be Documents. Any associated index information is defined for 
done. 60 cases and subsdocuments when they are defined to the 
The Records Manager may access the hold mode to system and sub-dociunent retention is set when the sub- 
review and certify sub-documents which have been previ- document type is defined under the appropriate document 
ously placed on hold. Data, sub-documents or pages in bold type. 

mode may also be deleted or left in hold mode upon exit. Retention types include (1) date-driven retention (a period 

Sub-documents which, for internal, legal or regulatory 65 in months is assigned at certification (or a default is used) 

reasons, are excepted from the normal disposal cycle when and the sub-document is destroyed at the end of the period); 

they present themselves for destruction, may be recertified if (2) event-driven retention (retention will not begin until a 
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Specific event, e.g., termination of an employee or cancel- 
lation of a contract or policy, has occurred; the entry of the 

event date will trigger the beginning of the designated 
retention period); or (3) replacement retention (a document 
or file will remain within the system until a replacement of 
the same type is filed, at which point the first document on 
file will become available for disposal). 

No Case, Folder, Document or Sub-Document type may 
be deleted from the system if images or electronic files 
stored in the system are associated with that type until all 
images and electronic files have been deleted or transferred. 
Cabinets: 

Ihis set-up function allows the Records Manager to 
define locations conU^olled by the system where inaages and 
other electronic records and files are to be stored, both on a 
temporary basis (prior to certification) and a permanent basis 
(after certification). 

Information created during the set-up of cabinets includes 
the purpose; DOS path used by the system to locate stored 
information; and the amount of storage remaining before the 
system issues a warning message that the cabinet is nearly 
fidl. A cabinet in which information has been stored may not 
be deleted torn the system until all stored information has 
been transferred or purged. 
Bullets: 

Bullets are set isp for case types within this fiinction. A 
group of icons is available to the Records Manager, who 
assigns bullet icon status flags to specific case types and 
assigns a name to the bullet annotation. Other properties of 
the bullet (e.g., the bullet may be assigned at case level or 
image level, bullet name may be displayed over images to 
which the bullet is attached, etc.) are defined at this time 
also. A bullet icon may not be attached to an image or case 
within a specific case type unless it has been previously set 
up by the Records Manager. 

System Utilities 

Id addition to the main four functions, a number of 
utilities are available in the present system, either from 
within some functions or from the Main Menu. These 
include: 

Send A Message 

The messaging utility is available to be run from the Main 
Menu. Send a message can be used to send messages to an 
individual user queue or to the general queue for workgroup 
handling. 

System Integrity 

liiis function is the same as that run automatically when 
users sign on to any of the four main functions. System 
integrity is checked and logged, except that results are 
printed as well as logged for audit purposes. 

Run System Backup 

Access to this function is restricted. When this function is 
accessed, the system prepares to run the ILM backup at the 
pre-selected date, time and firequency. 

Run System Restore 

Access to this function is restricted. When this function is 
executed, it begins an immediate rebuild of the ILM 
database, into which data is restored from a defined, prior 
database backup. This function is used to resolve database 
problems and purges all existing database information. 

General Queue 

This function allows a user to access the general message 
queue. Messages sent to this queue may be accessed by 
authorized users, who may "assign" a message to their own 
queue for handling. This queue may be used for assignment 
of case work within a group performing the same work 
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Search Utility 

The facility, which may also be accessed from within the 
retrieval function, allows a user to enter one of two search 
criteria fields and search the ILM database, either within a 
case type or across all case types within the system. The 
resulting list is displayed and may be printed, if necessary. 

Import Utility 

This utility allows a user to select electronic files to which 
he has access and to send the files to the scan application for 
importation and filing. 

There has been disclosed a system which meets the 
objectives first described. Other variations and embodiments 
may come to mind from a careful reading and study of the 
system description and drawings. The present invention 
should only be considered to be limited in scope by the 
claims which follow. 

We claim: 

1. A computer based records management system, com- 
prising: 

first input means for receiving record data units repre- 
senting and/or relating to records presented for possible 
retention, said first input means including indexing data 
receiving means for receiving indexing data relating to 
said records presented for possible retention, and stor- 
ing said indexing data in said third data storage means; 

first data storage means for temporarily storing record 
data units received by said input means; 

verification/certification means for verifying/certifying 
the suitability for retention of the record data units 
temporarily stored in said first data storage means; 

second data storage means for storing record data units 
that are verified/certified for retention by said 
verification/certification means; 

retrieval means for allowing a user to retrieve record data 
units stored in said second data storage means; 

third data storage means for storing a record of record data 
units received by the first input means and disposal 
schedules for record data units stored in said second 
data storage means; and 

disposal means for disposing of record data units stored in 
said second data storage means in accordance with the 
stored disposal schedules. 

2. A computer based records management system accord- 
ing to claim 1, wherein said indexing data receiving means 
comprises means for input by a user of indexing data relating 
to said records presented for possible retention. 

3. A computer based records management system accord- 
ing to claim 1, wherein said indexing data receiving means 
receives indexing data relating to records to be stored 
off-line. 

4. A computer based records management system accord- 
ing to claim 3, wherein said indexing data receiving means 
receives indexing data relating to hard-copy documents, 
including a storage location of said hard-copy documents. 

5. A computer based records management system accord- 
ing to claim 3, wherein said indexing data receiving means 
receives indexing data relating to records stored on off-line 
computer readable data storage media, including a storage 
location of said data storage media. 

6. A computer based records management system accord- 
ing to claim 1, wherein said indexing data receiving means 
receives indexing data firom said record data units. 

7. A computer based records management system accord- 
ing to claim 1, wherein said first input means further 
comprises record converting means for converting records 
presented for possible retention into a computer recogniz- 
able form. 
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8. A computer based records management system accord- tion to a deletion of pointers to the storage locations for such 
ing to claim 7, wherein said record converting means record data units. 

comprises a document scanner. 24. A computer based records management system 

9. A computer based records management system accord- according to claim 1, further comprising information filter- 
mg to claim 7 wherem said record convertmg means ^ ^ ^^^^ categorizing record data units for further 
comprises a system for converting audio records into a * . & © 

computer recognizable form. processing. 

10. A computer based records management system ^5. A computer based records management system 
according to claim 7, wherein said record converting means according to claim 24, wherein said information filtering 
comprises a system for converting video records into a means identifies incomplete and/or redundant record data 
computer recognizable form. lo units prior to any passage of said record data units to said 

11. A computer based records management system verification/certification means. 

according to claim 1, wherein said first input means com- 26. A computer based records management system 

prises an electronic mail receiving system. according to claim 24, wherein said information filtering 

12. A computer based records management system means serves to route record data units to their designated 
according to claim 1, wherein said first input means com- ^5 destinations. 

prises a facsimile receiving system. 27. A computer based records management sjrstem 

13. A computer based records management system according to claim 26, wherein said information filtering 
according to claim 1, wherein said verification/certification means routes record data units to designated user work 
means generates a message to prompt a user to verify/certify stations prior to any passage of said record data units to said 
the suitability of temporarily stored record data units for verification/certification means. 

retention. 28. A computer based records management system 

14. A computer based records management system according to claim 26, wherein said information filtering 
according to chim 1, wherein said verification/certification means routes record data units to designated business appli- 
means performs an automatic verification/certification of cation programs prior to any passage of said record data 
record data units based upon preset criteria, and updates the units to said verification/certification means. 

third data storage means to reflect the verification/ ^5 29. A computer based records management system 

certification of record data. according to claim 26, wherein said information filtering 

15. A computer based records management system means serves to identify record data units requiring special 
according to claim 1, wherein said third data storage means handling prior to any passage of said record data units to said 
stores record disposal schedules included in the record data verification/certification means. 

units received by said first input means. 30 30. A computer based records management system 

16. A computer based records management system according to claim 26, wherein said information filtering 
according to claim 1, wherein said di^osal means com- means tags record data units passing therethrough so as to 
prises a second input means allowing a user to input di^osal indicate which record data units are to be passed on to said 
schedules for storage in said third data storage means. verification/certification means. 

17. A computer based records management system 35 31. A computer based records management system 
according to claim 1, wherein said disposal means generates according to claim 30, wherein said tag$ further enable 
a message to prompt a user to confirm those records to be location, copy and version tracking of the record data units 
disposed of in accordance with the stored disposal sched- in the system. 

ules. 32. A computer based records management system 

18. A computer based records management system according to claim 31, wherein said first data storage means 
according to claim 17, wherein said confirmation means ^ comprises capture means for capturing location and version 
further provides a user with an option lo delay or suspend tracking information and passing said information on for 
disposal of records scheduled for disposal. storage in said third data storage means. 

19. A computer based records management system 33. A computer based records management system 
according to claim 1, wherein said second data storage according to claim 24, wherein said information filtering 
means comprises on-line storage media located on a plural- means serves to send any required acknowledgements of 
ity of hardware/software platforms interconnected by an receipt of record data units. 

area computer network. 34. A computer based records management system 

20. A computer based records management system according to claim 1, further comprising audit means for 
according to claim 1, wherein said stored disposal schedules making a record of processing actions of the system, 
comprise one or more of: version based schedules, time 50 35. A computer based records management system 
based schedules, source based schedules, type based sched- according to claim 34, wherein said audit means makes a 
ules and use based schedules. record of actions taken by said information filtering means. 

21. A computer based records management system 36. A computer based records management system 
according to claim 1, wherein said disposal means generates according to claim 35, wherein said record of actions taken 
a message indicating a need to dispose of off-line records in by the information filtering means includes a listing of one 
accordance with the stored disposal schedules, and allows or more of: recipients of record data units, acknowledge- 
for user input to verify disposal of off-line records, said third ments of receipt of record data units, non-delivered record 
data storage means being updated to reflect said user input. data units, record data units being held, and record data units 

22. A computer based records management system requiring special handling. 

according to claim 21, wherein said disposal means peri- 37. A computer based records management system 

odically generates a status report containing a list of off-line according to claim 34, wherein said audit means makes a 

records due and overdue for disposal, said status report record of actions taken by said verification/certification 

being periodically updated to reflect said user input to verify means. 

disposal of off-line records. 38. A computer based records management system 

23. A computer based records management system according to claim 34, wherein said audit means makes a 
according to claim 1, wherein the dii^osal of records by said 65 record of actions taken by said disposal means, 
disposal means comprises an erasure of the record data units 

corresponding to documents scheduled for disposal, in addi- * « « « « 



05/26/2004, EAST Version: 1.4.1 



